Just forward w/o transformation possible?

[hannes-angst]

The application logging to stdout already writes perfectly correct splunk event json payloads.

{
  "time": 1586785686388,
  "index": "my-index",
  "source": "my-application",
  "event": {
    "severity": "INFO",
    "severity_value": 20000,
    "message": "GET /hello",
    "x-trace-id": "my-id"
  }
}

Is it possible to just pass the data through?